1

Note: i am reposting the question as i am not able to reply or comment.

I am creating a non-root user to execute an object file alone (without root access). My intention is to have the user run a file which is residing at /atlas/Bin. So i set /etc/passwd as user:x:0:0:test:/:/atlas/Bin/object. But when I open a new shell(through teraterm) over SSH to login to the user, I get an error as it cannot find the object.

I have made the changes to /etc/profile to set the PATH to include /atlas/Bin to help find the object. Not sure what I am missing here. If I instead login with the root user over SSH, I can execute this object without an issue.

I am providing the /etc values I use for the build file below.

/etc/passwd

root:x:0:0:root:/:/bin/sh
....
user:x:0:0:test:/:/atlas/Bin/object
sshd:x:15:6:sshd:/var/chroot/sshd:/bin/sh

/etc/group

root:x:0:root
...
sshd:x:6:user

/etc/profile

PATH=/atlas/Bin:/usr/bin:/bin:/usr/sbin:/sbin
LD_LIBRARY_PATH=/lib:/usr/lib:/lib/dll/
alias ll="ls -l"

/etc/ssh/ssh_config

Host *
SendEnv LANG LC_* 

/etc/ssh/sshd_config

Protocol 2
LoginGraceTime 600
LogLevel    DEBUG3
PermitRootLogin yes
PasswordAuthentication yes
PermitEmptyPasswords no

closed as off-topic by DopeGhoti, Anthony Geoghegan, Kusalananda, Rui F Ribeiro, GAD3R Apr 22 '17 at 12:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – DopeGhoti, Anthony Geoghegan, Kusalananda, Rui F Ribeiro, GAD3R

  • 3
    By running the binary that way, you're missing out on the normal user shell startup sequence, some of which may matter here. What happens if you give the user a normal login shell but put the /atlas/Bin/object executable call in at the end of the user's .profile or .bash_profile? Also, are you sure it's Bin and not bin? I don't know if QNX's filesystem is case-sensitive, but if it is, that difference will matter. – Warren Young Apr 20 '17 at 23:34
  • My intention is to not provide the user with root access. This particular user should login only to run this binary! I am sure it is Bin. – user3512111 Apr 20 '17 at 23:55
  • So make the command exec /atlas/Bin/object, so that the user is logged out as soon as that program exits. – Warren Young Apr 21 '17 at 1:16
  • 3
    As for providing the user root access, you might want to re-think giving the user ID 0. That not only gives this "atlas" program root access, it means any security vulnerability in that program becomes a remote root access vulnerability. But that is a separate question, better taken up elsewhere. – Warren Young Apr 21 '17 at 1:16
  • Cross-posted questions are usually closed. I'd advise deleting the Stack Overflow version because it's not on-topic for that site (and is likely to be closed for that reason). – Anthony Geoghegan Apr 21 '17 at 8:38
1

If you want to use the excutable as shell for the user, then you may need to add the program to /etc/shells.

You may want to use a restricted shell for the user with a profile that runs your script and exits.

You may be able to use /bin/false as the shell and a command specified in the authorized_keys file for the key being used to access the server. If /bin/false doesn't work try a restricted shell such as /usr/bin/rbash.

Not the answer you're looking for? Browse other questions tagged or ask your own question.